There’s a big issue in a popular WordPress backup plugin that lets unauthenticated attackers exploit it. This vulnerability is rated pretty high at 8.8 out of 10 on the severity scale.
UpdraftPlus: WordPress Backup and Migration Tool
The problem affects UpdraftPlus, which is a backup plugin found on over 3 million websites. You can get UpdraftPlus for free or pay for extra features, and it lets you save backups to cloud storage or email them. It has options for both manual backups and automated ones, making it super handy for recovering from serious server problems or moving to a new server.
The UpdraftPlus: WP Backup & Migration Plugin has a flaw linked to PHP Object Injection in all versions up to and including 1.24.11. This is because of the deserialization of untrusted input in the ‘recursive_unserialized_replace‘ function. This means unauthorized attackers can insert a PHP object. There’s currently no known way to exploit this in the vulnerable software itself, but if another plugin or theme has a path for exploitation, it could let the attacker delete files, access private info, or run any code they want. An admin has to do a search and replace to trigger the exploit.
Plugins are what make WordPress great, but they can also be a source of vulnerabilities if not properly managed.
In the changelog for Updraft Plus, it seems they downplay the seriousness of the vulnerability. They didn’t label the update as a security patch but called it a “tweak.” According to the official…Changelog for the Updraft Plus WordPress plugin.:
“TWEAK: Finalize the review and remove unserialize() PHP function calls used for class instantiation, a job that started in version 1.24.7. This complete removal handles a potential security issue that could pop up if your development site allowed an attacker to upload content that gets sent to another site and had custom code to execute harmful actions the attacker knew about before you cloned it. So, with this removal, certain search-replace operations—while unlikely in real life—will get skipped.”
Updraft Plus Vulnerability Fixed
Users should update their Updraft Plus to the latest version, 1.24.12, since all previous ones have vulnerabilities.
